CVE-2026-108791: Path Traversal in westboy CicadasCMS

A path traversal vulnerability exists in westboy CicadasCMS up to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab, specifically in the TemplateController.input function of the /system/cms/template/input file within the Template Management component. This flaw allows remote attackers to manipulate the filePath parameter to traverse directories and potentially access unauthorized files. The vendor was contacted but did not respond, and no official patch or fix has been disclosed. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation of this vulnerability could allow remote attackers to read arbitrary files on the affected system by leveraging path traversal via the filePath parameter. This could lead to unauthorized disclosure of sensitive information. No evidence of active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing temporary mitigations such as restricting access to the vulnerable component, applying web application firewalls to detect and block path traversal attempts, and monitoring for suspicious activity related to filePath parameter usage.